Source: MIZOKI audit 2026-09-06 (pinned fc8b03f9) → work-order backlog 2026-09-08 (docs/audits/AUDIT_WORK_ORDERS_2026-09-08.md). Findings are hypotheses until reproduced on current main (WO-00).

Finding: Companion to WO-15: role checks exist only on some routes. Files: miz-oki-command-center-ui/app/api/**/route.ts. Fix: generate a route → required-role table; every mutating route must have a non-null entry. Acceptance: CI test fails if a mutating route has no role annotation. Depends on: WO-15.